#!/bin/bash

# ----------------------------------------------------------------------
# Filename:   ftp_hosts_limit.sh
# Version:    1.0
# Date:       2013/08/16
# Author:     huijing.hei
# Email:      huijing.hei@cs2c.com.cn
# Summary:    02系统基本功能-04网络服务-01vsftp-01字符模式-04主机访问控制
# Notes:       ***
# Copyright:    China Standard Software Co., Ltd.
# History：     
#             Version 1.0, 2013/08/16
#             - Deny some hosts login.
# ----------------------------------------------------------------------
##! @TODO:  update vsftpd.conf, and restart vsftpd
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function do_setup()
{
    serv=vsftpd
    RHOST=${RHOST}

    TEST_USER="anonymous"
    TEST_USER_PASSWD="noone@nowhere.com"
    VSFTP_CONF="/etc/vsftpd/vsftpd.conf"
    HOSTS_CONF="/etc/hosts.allow"

    exists expect ftp vsftpd
    EchoResult "check commands"

    ${RSH} -l root -n $RHOST "cp $VSFTP_CONF $VSFTP_CONF.bak; cp $HOSTS_CONF $HOSTS_CONF.bak"
    TMP_VSFTP_CONF="/tmp/vsftpd.conf" 
    cat > ${TMP_VSFTP_CONF} <<-EOF
anonymous_enable=YES

local_enable=YES

write_enable=YES

local_umask=022

dirmessage_enable=YES

xferlog_enable=YES

connect_from_port_20=YES

xferlog_std_format=YES

chroot_local_user=NO

listen=YES

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
pasv_max_port=1024
EOF

    ${RCP} $TMP_VSFTP_CONF root@$RHOST:$VSFTP_CONF
    # restart 
    ${RSH} -l root $RHOST \
       "command -v systemctl && /bin/systemctl restart ${serv}.service || /sbin/service ${serv} restart"

    RE=`${RSH} -l root $RHOST \
       "/bin/netstat -ntlp | grep ${serv}"`
    echo "${RE}" | grep ${serv}
    EchoResult "service ${serv} restart test."


    # update hosts.allow on remote host
    TMP_HOSTS_CONF="/tmp/hosts.allow"
    echo "sshd:all:allow" >> $TMP_HOSTS_CONF
    echo "vsftpd:10.1.50.0/255.255.255.0:allow" >> $TMP_HOSTS_CONF
    echo "vsftpd:all:deny" >> $TMP_HOSTS_CONF
    ${RCP}  $TMP_HOSTS_CONF root@$RHOST:$HOSTS_CONF

    trap do_cleanup INT EXIT

}

##! @TODO:  client with 10.1.40.0, not allowed to login.
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function do_test()
{
    echo "Test: client not allowed to login"    
    expect -c "
        spawn ftp $RHOST
        #expect -re \": \"
        #send \"$TEST_USER\r\"
        expect { 
            # password - failed
            \"Password:\" { send_user \"==> TEST : FAIL (ftp rejected login attempt)\n\";exit 1 }
            # 421 - Service not available
            \"421\" {send_user \"==> TEST : PASS (ftp not allowed to login)\n\"}
        }

       expect \"ftp> \"
       send \"bye\r\"

       expect eof

       catch wait result
       exit [lindex \$result 3]

    "
}

##! @TODO:  cleanup tmp files, back up vsftpd.conf and restart ftp services.
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure
function do_cleanup()
{
    ${RSH} -l root -n $RHOST "[ -f $HOSTS_CONF.bak ] && mv -f $HOSTS_CONF.bak $HOSTS_CONF"
    ${RSH} -l root -n $RHOST "[ -f $VSFTP_CONF.bak ] && mv -f $VSFTP_CONF.bak $VSFTP_CONF"
    ${RSH} -l root -n $RHOST "command -v systemctl && /bin/systemctl stop ${serv}.service || /sbin/service ${serv} stop"

    rm -rf $TMP_VSFTP_CONF $TMP_HOSTS_CONF

}
# include lib files

if [ -z "$SFROOT" ]
then
    CMDLIB=./
    SFROOT=./
else
    CMDLIB=${SFROOT}/testcases/Network_Service
fi

. ${SFROOT}/lib/Echo.sh
. ${CMDLIB}/lib/Net.sh
. ${SFROOT}/lib/XmlParse.sh

. ${CMDLIB}/setup.sh

# get RHOST, RUSERNAME, PASSWORD from config.xml
DATA_FILE="${SFROOT}/testcases/Network_Service/config.xml"
[ -e $DATA_FILE ] || { echo "$DATA_FILE not find, test end."; exit 1; }

XmlParse ${DATA_FILE}

GetValue REHOST ReHost
GetValue RUSERNAME UserName
GetValue PASSWORD RootPasswd

export RHOST=${REHOST}
export RUSERNAME=${RUSERNAME}
export PASSWORD=${PASSWORD}


setup_env || { echo "setup env failed, test end."; exit 1; }

do_setup
do_test || { echo "testcase failed."; exit 1; }
